Nivoli Edge: Login Security, WP Audit and Firewall

Security one layer above WordPress. Audit what your site exposes, lock down logins, and stop attacks at Cloudflare's edge before they reach PHP. Even if someone takes over wp-admin, your protection stays on. Login Security

• Login rate limit: 10 attempts per 10 minutes per address, answered at the edge
• Login country lock: wp-login.php only for the countries you list
• wp-admin IP lock: only your addresses, with a self-lockout guard and email rescue
• XML-RPC block: no guessing hundreds of passwords in one request
• Hidden usernames: nothing to find at ?author=N or in the REST API
• Code at login: every piece of code that runs when someone logs in, who put it there, and the warning signs a password thief leaves

WordPress Security Audit

• Security check: 19 checks of what your site exposes, from inside WordPress and from its own front door
• Hidden from itself: unlisted must-use plugins, administrators the Users screen does not show, suspicious login code
• Hardening: 8 one-click fixes (XML-RPC, usernames, code editors, security headers, version leaks), also as a must-use plugin nothing in wp-admin can disable
• Plain answers: every finding says what it means and how to fix it

Edge Firewall Thirteen shields at Cloudflare's edge: your server never runs PHP to turn an attack away.

• Stray-PHP lock: every .php request except WordPress's own entry points refused
• Surface lock: user lists, readme.html, the installer and debug.log closed to visitors
• Traversal guard: path tricks refused in any encoding
• PHP parser guard: malformed or oversized uploads and other requests built to exploit PHP's own request handling are refused before PHP reads them, and virtual patches for newly disclosed PHP flaws reach every site within minutes. It reduces exposure to flaws like PHP2Shell (October 2026) but does not replace updating PHP, and it only sees traffic that comes through Cloudflare, so your server should accept connections from Cloudflare only.
• Scanner lockout: five refusals and the address is shut out for ten minutes
• Flood limits: comment and search floods stopped per address
• AI-crawler block and security headers on every response
• Monitor mode: see what a shield would block before it blocks anything
• Cloudflare's managed WAF rulesets in front of every site on the edge

Protection that stays on after a takeover A takeover of wp-admin owns every plugin's settings. These are held at the edge.

• Change lock: weakening protection waits for a click on a link mailed to you
• Install lock: plugin and theme installs, updates and activations refused until you open a 15-minute window by email, whether they come from wp-admin or a remote-management key (UpdraftCentral, ManageWP, MainWP, Jetpack), and the wp-admin file editors closed. It cannot stop code already running on your server or files written to it directly
• Origin lock: code changes that skip the edge are refused, so knowing your server's address does not help
• Activity log: every refused attempt on the Locks page, with what was tried and how it arrived

Speed and uptime

• Edge page cache: full pages from Cloudflare's network, with surgical purge so only the pages a change touches refresh
• Origin Shield: your site keeps serving when your server is down
• Right-sized images: WebP and AVIF through your own Cloudflare zone or the Managed Images add-on
• Analytics without a tracking script: audience, attacks and top URLs from the edge

Free and with a plan Free on every install, no account: the security check, Hardening, Code at login, the image tools on your own Cloudflare zone, and page-cache purging to your own Fastly, Cloudflare Enterprise or webhook. With a Nivoli plan: the edge firewall, the three locks, the login rate limit, country lock and wp-admin IP lock, the edge page cache, Origin Shield and the edge analytics. Every plan starts with a 14-day free trial. Requirements

• WordPress 6.2+ and PHP 7.4+. The security tools need nothing else.
• Image tools on your own zone: Cloudflare with Image Resizing (Images → Pipeline check verifies it). Page cache on your own edge: Fastly, Cloudflare Enterprise or a webhook.
• Managed: an API key, plus the DNS records the setup pane shows.

Recent releases are listed below. The full history for every version is in CHANGELOG.md, which ships with the plugin, and on the GitHub releases page. 1.104.1 Fixes 1.104.0 refusing WordPress loaded from the command line, such as a server cron job running wp-cron.php: the origin lock counted it as an install request, so scheduled tasks stopped. The command line is not a request and is left alone; code changes from it stay under the install lock. 1.104.0 The origin lock can cover the whole site: off, monitor (requests that skip the edge are logged) or enforce (they are refused), with enforce offered after 24 hours of monitoring. It runs before other plugins, heals itself when the secret changes, and stands down loudly (notice, Site Health, one email) if the edge stops stamping. Optional .htaccess block for static files on Apache and LiteSpeed, an nginx snippet with a copy button, one-click secret rotation, a This server stream in the Security log and wp nivoli-edge origin-lock. The install lock also catches encoded, dot-segment, path-info, backslash and method-override forms of install requests that reached the server directly. 1.103.0 The install lock now also refuses the ways WordPress runs a plugin or theme already on disk without activating it: the plugin error check and recovery-mode resume on the Plugins and Themes screens, a theme preview link (wp_theme_preview), and the Customizer previewing a theme that is not active. Customizing the active theme is unchanged. Each refusal is logged on the Locks page like the others. 1.102.1 A license with several sites now shows its shared image allowance on the Usage & quota pane and the dashboard card (all its sites' usage against the license's budget, the number a pause is decided on) instead of this site's own count beside a pause it did not explain. The dashboard card counts unique variants, like the Usage pane. 1.102.0 New Security log (Security, Activity): everything the edge refused or watched on your site and every change to its locks and settings on one timeline, newest first. Filter by shield, result, window, sender (people or bots), path shape, network, country and your own requests; account activity by kind and channel. Every shield card's request log opens it pre-filtered, and Lock activity links to it. Shield Plus and Agency add saved views and CSV export. The page says how long each record is kept and that no visitor address is stored. 1.101.1 The 404 import counts an old address as wanted by people only when two or more visitors asked or a link on another site led there; one scanner sending a browser's name no longer fills the list. Recent 404s points to the 404 import's visitor list. 1.101.0 Every request log row says what the edge answered (404, 403 lockout, 429, 423, or watched), with the run count beside it. Triggers say what they are (query -s), long paths are shortened at slashes, countries show as codes with their name on hover, network names drop legal suffixes, and opaque path shapes get readable names. The lockout tile says how many sources its refusals came from. 1.100.0 404 import with a second source, your own visitors: one click loads every dead address real people reached in the last 30 days straight from the edge, with how many visitors, where they came from and how many bots, into the same worklist as a Search Console export, families people hit most first. Addresses only bots asked for are left out. An old index file of a live page (/2017/05/15/post/index.php) gets the page itself as its redirect, one by one or as one pattern, and the edge answers it before Block stray PHP. The Overview counts old URLs people still followed last week. 1.99.0 The plugin tells the edge this server's address as soon as the site is connected and refreshes it weekly from wp-admin, instead of waiting for a scheduled task that may never run. The edge uses it to recognize the site's own requests, including WordPress's scheduled tasks. 1.98.0 The request log reads at a glance: two-line rows with the path on one line, day headers, details on click, and a summary of the paths, networks and countries hitting the site, each a filter. A By path view folds thousands of similar URLs into one row with a seven-day sparkline. 1.97.1 The PHP parser guard's new rule against malformed session cookies has a name and a plain explanation on the shield card and in the request log. 1.97.0 The request logs group repeats: consecutive requests from one sender refused by the same rule are one row with the count, the paths and the time span, so one scanner's hundreds of lockout repeats no longer bury everything else. The every-shield log can be narrowed to one shield. 1.96.3 The PHP parser guard card reads right when the edge default blocks every rule: "every rule and the virtual patches block", the tile says shield on, and no watch list is shown for the default.